Data Processing Agreement

The following table sets out the Data Protection Laws referenced in this DPA, their abbreviated terms, and the jurisdictions to which they apply. This mapping is used to determine which jurisdiction-specific obligations under Section 3.9 and Schedule F, and which cross-border transfer mechanisms under Section 3.8 and Schedule D, are applicable to the Processing.

Nature and Purpose of Processing: The Processor shall Process Personal Data on behalf of the Controller solely for the following purposes, as applicable to the Services under the Main Agreement:

• Provision of information technology services, including application development, maintenance, testing, infrastructure management, and cloud hosting.
• Business process management and outsourcing services, including transaction processing, data entry, and back-office operations.
• Consulting and advisory services, including management consulting, digital transformation, and strategy advisory.
• Engineering services, including product design, development, and lifecycle management.
• Human resources administration, including recruitment, onboarding, payroll processing, benefits administration, performance management, learning and development, and workforce management.
• Finance and accounting operations, including accounts payable and receivable, general ledger management, tax compliance support, and expense management.
• Customer relationship management, including sales support, client onboarding, customer service, and complaint handling.
• Procurement and supply chain management, including vendor management, purchase order processing, and logistics support.
• IT helpdesk, service desk, and end-user computing support.
• Data analytics, reporting, and business intelligence services.
• Cybersecurity and information security services, including security monitoring, threat detection, vulnerability management, and incident response.
• Communication and collaboration services, including email hosting, unified communications, and document management.
• Compliance, audit, and risk management support.
• Any other Processing activities specifically described in the Main Agreement or a Statement of Work.

Duration of Processing: Processing shall continue for the term of the Main Agreement (including any renewals or extensions) plus any applicable data retention periods required by Applicable Data Protection Laws or as specified in the Main Agreement.

Categories of Personal Data:

Categories of Data Subjects: The following categories of Data Subjects may be affected by the Processing under this DPA, as applicable to the Services:

Special Categories / Sensitive Personal Data: [Specify if applicable, with additional safeguards. Where Sensitive Personal Data is processed, the Parties shall ensure that explicit consent or another valid legal basis has been obtained in accordance with Applicable Data Protection Laws, and that enhanced technical and organizational measures are implemented as set out in Schedule B.]

The Processor shall maintain an information security management system aligned with recognized standards (e.g., ISO/IEC 27001 or equivalent). The Processor shall designate a responsible individual or team accountable for information security and data protection. All personnel with access to Personal Data shall be subject to binding confidentiality obligations and shall receive regular training on data protection, information security, and awareness of Data Breach risks. The Processor shall maintain and enforce acceptable use policies, clear desk and clear screen policies, and role-based segregation of duties. The Processor will conduct background checks on personnel with access to Personal Data, to the extent permitted by applicable law.

The Processor shall implement physical access controls at all facilities where Personal Data is processed or stored, including perimeter security, access card systems, visitor management procedures, and CCTV surveillance. Data center facilities shall be protected by multi-layered physical security controls, including biometric access, mantrap entries, 24/7 security personnel, and environmental controls (fire suppression, climate control, flood detection, and uninterruptible power supply). Physical media containing Personal Data shall be securely stored and disposed of through certified destruction methods when no longer required.

The Processor shall implement role-based access controls (RBAC) ensuring that access to Personal Data is limited to authorized personnel on a need-to-know basis. Multi-factor authentication (MFA) shall be required for remote access, privileged accounts, and access to systems containing Sensitive Personal Data. The Processor shall enforce strong password policies, including complexity requirements, periodic rotation, and account lockout after failed authentication attempts. User access rights shall be reviewed periodically (at least quarterly for privileged accounts) and promptly revoked upon termination of employment or change of role. All access to systems containing Personal Data shall be logged and monitored.

The Processor shall implement network security controls including firewalls, intrusion detection and prevention systems (IDS/IPS), network segmentation, and secure configuration baselines for all infrastructure components. The Processor shall maintain patch management procedures to ensure timely application of security patches and updates to operating systems, applications, and firmware. The Processor shall deploy endpoint protection solutions (anti-malware, endpoint detection and response) on all devices that access or process Personal Data. Remote access shall be secured through encrypted VPN connections or equivalent secure access solutions.

The Processor shall implement encryption of Personal Data at rest using industry-standard algorithms (e.g., AES-256 or equivalent). All transmissions of Personal Data shall be encrypted in transit using TLS 1.2 or higher, or equivalent protocols. Encryption key management procedures shall be documented, including secure key generation, storage, rotation, and destruction. The Processor shall apply pseudonymization and anonymization techniques where appropriate to minimize the risk of identification of Data Subjects.

The Processor shall maintain a data classification framework that categorizes Personal Data based on sensitivity and applicable regulatory requirements. Handling procedures shall be defined for each classification level, addressing collection, storage, transmission, retention, and disposal. Sensitive Personal Data shall be subject to enhanced protection measures, including additional access restrictions, encryption requirements, and audit logging. The Processor shall maintain an inventory of systems and applications that process Personal Data.

The Processor shall follow secure software development lifecycle (SDLC) practices, including security requirements analysis, secure coding standards, code review, and security testing. The Processor shall conduct regular vulnerability assessments and penetration testing (at least annually, or upon material changes) of applications and infrastructure that process Personal Data. The Processor shall remediate identified vulnerabilities in accordance with documented timelines based on severity.

The Processor shall maintain a documented incident response plan covering identification, containment, investigation, eradication, recovery, and post-incident review of security incidents and Data Breaches. The Processor shall operate security monitoring capabilities (e.g., Security Information and Event Management (SIEM)) to detect and respond to potential security incidents in a timely manner. The Processor shall conduct incident response exercises and tabletop simulations at least annually. Incident response procedures shall be aligned with the breach notification timelines set out in Section 5 of this DPA.

The Processor shall maintain business continuity and disaster recovery plans to ensure the availability and resilience of systems processing Personal Data. The Processor shall perform regular backups of Personal Data and test restoration procedures at least annually. Business continuity plans shall include defined recovery time objectives (RTO) and recovery point objectives (RPO) appropriate to the nature of the Services. The Processor shall conduct business continuity exercises and update plans based on lessons learned.

The Processor shall conduct security due diligence assessments of all subprocessor’s prior to engagement and on a periodic basis thereafter. Subprocessor’s shall be contractually required to implement technical and organizational measures at least equivalent to those described in this Schedule B. The Processor shall maintain a risk-based monitoring program for subprocessor’s, including periodic reassessment of their security posture and compliance with contractual obligations.

The Processor shall retain Personal Data only for as long as necessary to fulfill the Processing purposes set out in Schedule A or as required by applicable law. Upon expiry of the retention period, termination of the engagement, or at the Controller's request, the Processor shall securely delete or destroy Personal Data using industry-standard methods (e.g., cryptographic erasure, degaussing, or physical destruction for media). The Processor shall provide certification of deletion upon the Controller's request.

The Processor shall maintain certifications or attestations demonstrating compliance with recognized security standards (e.g., ISO/IEC 27001, SOC 2 Type II, or equivalent). The Processor shall make audit reports, certifications, and relevant compliance documentation available to the Controller upon reasonable request. The Processor shall conduct internal audits of its security controls at least annually and shall remediate findings within documented timelines.

These measures shall be aligned with the requirements of all Applicable Data Protection Laws and shall be subject to periodic review and enhancement.

• Data Exporter: [Controller Name], [Jurisdiction], [Role: Controller/Processor]
• Data Importer: [Processor/Vendor Name], [Country], [Role: Processor]
• Contact Persons: [Names/emails]

• Categories of Data Subjects: [e.g., Customers, employees, website users]
• Types of Personal Data: [e.g., Name, email, IP address, billing information; sensitive data: Yes/No]
• Volume/Frequency: [e.g., Ongoing, approximately 10,000 records/month]
• Purpose: [e.g., Cloud hosting, analytics, customer support per Main Agreement]
• Transfer Tool Relied On: [e.g., 2021 EU SCCs (Module 2 Controller-to-Processor) + UK Addendum / DPF certification]
• Destination Country: [e.g., United States]
• Onward Transfers/Sub-processors: [Yes/No; list if applicable]

• Adequacy Decision: [Yes/No; if yes, specify]
• If No Adequacy: Transfer tool = [SCCs/IDTA]; valid and executed: [Yes/No]
• Derogations (e.g., GDPR Art. 49): [Not relied on / Relied on (specify)]

• Relevant Legislation: [e.g., For US: FISA 702, EO 12333, CLOUD Act]
• Government Access Risk: [Description of surveillance scope and likelihood]
• Practical Application: [Assessment of likelihood of access to the specific dataset]
• Importer Commitments: [e.g., No knowledge of incompatible requests; notifies exporter per SCC Clause 14]
• Overall Risk Level: [Low / Moderate / High]
• Supplementary Measures Required: [Yes / No]

• The Processor shall process Personal Data only on the Controller's documented instructions and for the specified purposes, in compliance with Argentina's PDPL (Law No. 25,326) and its implementing regulations.
• The Processor shall implement technical and organizational security measures appropriate to the nature of the Personal Data, as required under the PDPL and applicable regulations of the Agencia de Acceso a la Información Pública (AAIP).
• The Processor shall assist the Controller in fulfilling Data Subject rights, including rights to access, rectification, deletion (supresión), and confidentiality, within the statutory timelines.
• The Processor shall not transfer Personal Data to countries or international bodies that do not provide adequate levels of protection, unless a recognized exception applies (e.g., contractual clauses, explicit consent, or Argentina's EU adequacy status).
• The Processor shall notify the Controller without undue delay of any Data Breach and shall cooperate with the Controller in responding to inquiries from AAIP.
• The Processor shall retain Personal Data only for as long as necessary for the agreed purposes and shall securely delete or return data upon termination of the engagement.

• Where the Processor holds Personal Data (including as an outsourced service provider), it shall comply with the APPs as an APP Entity, including APP 6 (use or disclosure only for permitted primary or secondary purposes), APP 11 (reasonable steps to protect from misuse, interference, loss, or unauthorized access, modification, or disclosure), and APP 8 (cross-border disclosure).
• The Processor shall assist the Controller with access, correction, and complaints handling under APPs 12–13.
• The Processor shall comply with any applicable requirements arising from 2024–2026 amendments, including enhanced transparency for automated decision-making under new APP 1.7 (effective 2026).
• The Processor shall retain Personal Data only for as long as necessary for the agreed purposes and shall take reasonable steps to destroy or de-identify data when no longer needed under APP 11.2.
• The Processor shall cooperate with the OAIC in any investigation or inquiry and shall maintain adequate records of Processing activities.

• The Processor shall comply with LGPD principles of purpose limitation, adequacy, necessity, transparency, and data security in all Processing activities.
• The Processor shall assist with ANPD notifications, including breach reporting and regulatory inquiries.
• The Processor shall support the Controller in responding to Data Subject rights requests, including access, correction, anonymization, portability, and deletion, within the timelines prescribed by LGPD.
• The Processor shall maintain records of Processing activities and cooperate with the Controller in preparing data protection impact reports (relatório de impacto) when required by ANPD.
• The Processor shall implement technical and administrative security measures adequate to protect Personal Data from unauthorized access, accidental or unlawful destruction, loss, alteration, or disclosure as required under Article 46.
• The Processor shall ensure that any international transfer of Personal Data complies with LGPD Chapter V requirements, including use of SCCs or other approved mechanisms.

• The Processor shall process Personal Data only for the purposes identified by the Controller and in accordance with PIPEDA Principle 4.2 (Identifying Purposes) and Principle 4.5 (Limiting Use, Disclosure, and Retention).
• The Processor shall implement security safeguards appropriate to the sensitivity of the Personal Data, as required under PIPEDA Principle 4.7 (Safeguards), including physical, organizational, and technological measures.
• The Processor shall assist the Controller in responding to Data Subject (individual) access requests and challenges to accuracy under PIPEDA Principles 4.9 (Individual Access) and 4.6 (Accuracy).
• The Processor shall notify the Controller without undue delay of any Data Breach that creates a real risk of significant harm, to enable the Controller to report to the Office of the Privacy Commissioner of Canada and affected individuals as required under PIPEDA's breach notification provisions.
• The Processor shall not transfer Personal Data outside Canada without the Controller's instructions and shall ensure that any transfer is subject to contractual protections providing a comparable level of protection (PIPEDA Principle 4.1.3).
• The Processor shall comply with applicable provincial privacy legislation (e.g., Quebec Law 25, Alberta PIPA, British Columbia PIPA) where such legislation applies to the Processing, including enhanced consent, breach notification, and privacy impact assessment requirements.

• The Processor shall process Personal Data only on the Controller's documented instructions and in compliance with Chile's DPL (Law No. 19,628) and any applicable amendments or reformed data protection framework.
• The Processor shall implement appropriate security measures to protect Personal Data from unauthorized access, alteration, disclosure, or destruction.
• The Processor shall assist the Controller in fulfilling Data Subject rights, including rights to access, rectification, cancellation (deletion), and objection, as provided under the DPL.
• The Processor shall not transfer Personal Data outside Chile unless the recipient jurisdiction provides adequate protection or an exception applies (e.g., consent, contractual clauses, or legitimate interest under the applicable framework).
• The Processor shall notify the Controller without undue delay of any Data Breach and shall cooperate with the Controller in responding to inquiries from the relevant supervisory authority.
• The Processor shall retain Personal Data only for as long as necessary for the agreed purposes and shall securely delete or return data upon termination of the engagement.

• The Processor (as Entrusted Party) shall process Personal Data strictly within the scope agreed in this DPA (purpose, period, method, categories, and protection measures) and shall not process beyond such scope (PIPL Article 21).
• The Processor shall take necessary security measures and assist the Controller in responding to individual rights requests, breach notifications, and impact assessments (PIPL Article 59).
• Upon termination, expiration, invalidity, revocation, or completion of the entrustment, the Processor shall return or delete the Personal Data and shall not retain it (PIPL Article 21).
• The Processor shall allow and cooperate with supervision by the Controller of its processing activities (PIPL Article 21).
• The Processor shall not transfer Personal Data outside China without the Controller's instructions and appropriate safeguards, including execution or filing of CAC standard contracts if required, separate individual consent where mandated, and completion of an impact assessment.
• For transfers involving Sensitive Personal Data or large volumes, additional mechanisms (e.g., security assessment) may apply.

• The Processor shall process Personal Data only on the Controller's documented instructions and in compliance with Costa Rica's DPL (Law No. 8968) and its implementing regulations.
• The Processor shall implement appropriate technical and organizational security measures to protect Personal Data from unauthorized processing, loss, or damage.
• The Processor shall assist the Controller in fulfilling Data Subject rights, including rights to access, rectification, deletion, and restriction of Processing, as provided under the DPL.
• The Processor shall not transfer Personal Data outside Costa Rica without the Controller's instructions and shall ensure appropriate safeguards are in place, including contractual protections or PRODHAB-approved mechanisms.
• The Processor shall notify the Controller without undue delay of any Data Breach and shall cooperate with the Agencia de Protección de Datos de los Habitantes (PRODHAB) as required.
• The Processor shall retain Personal Data only for as long as necessary for the agreed Processing purposes and shall securely delete or return data upon termination of the engagement.

• The Processor shall Process Personal Data only on documented instructions from the Controller, in compliance with GDPR Articles 28 and 32 and the UK GDPR.
• The Processor shall assist with data protection impact assessments under Articles 35–36 and cooperate with supervisory authorities upon request.
• The Processor shall maintain a record of Processing activities carried out on behalf of the Controller as required under Article 30(2).
• Where Personal Data is transferred outside the EU/EEA or the UK, the Processor shall use SCCs, the UK IDTA, or other approved transfer mechanisms under Articles 46–49 and Schedule D.
• The Processor shall appoint a Data Protection Officer where required under Article 37.
• The Processor shall notify the Controller of any Data Breach without undue delay in accordance with Article 33.
• Upon termination or at the Controller's request, the Processor shall delete or return all Personal Data and certify such deletion, unless EU or Member State law requires continued storage.

• The Processor shall process Personal Data strictly per the Controller's instructions and only for the purposes specified in this DPA, in compliance with the Digital Personal Data Protection Act (DPDP Act’) and the Digital Personal Data Protection Rules, 2025 (Rules’).
• The Processor shall assist the Controller with consent management obligations, including facilitating withdrawal of consent by Data Subjects (Data Principals), and shall ensure that valid, informed, and specific consent is obtained and recorded as prescribed under the DPDP Act and Rules.
• The Processor shall support the Controller in fulfilling Data Subject (Data Principal) rights, including the right to access, correction, erasure, and nomination of a representative, within the timelines prescribed under the DPDP Act and Rules.
• Where the Controller is classified as a Significant Data Fiduciary, the Processor shall cooperate with additional compliance obligations under the DPDP Act and Rules, including periodic data audits by independent auditors, data protection impact assessments, appointment of a Data Protection Officer and an independent data auditor, and compliance with data localization requirements as may be notified by the Central Government.
• The Processor shall implement reasonable security safeguards as required under Section 8 of the DPDP Act and the corresponding provisions of the Rules, including encryption, access controls, and monitoring, to prevent Data Breaches. The Processor shall notify the Controller of any Data Breach without undue delay to enable the Controller to report to the Data Protection Board of India within the prescribed timelines.
• The Processor shall not retain Personal Data beyond the period necessary for the agreed Processing purpose and shall delete or return such data upon completion of Processing, termination of the engagement, or withdrawal of consent by the Data Principal, unless retention is required under applicable Indian law.
• The Processor shall comply with obligations regarding children's data, including obtaining verifiable consent from parents or lawful guardians where required, and shall not undertake tracking, behavioral monitoring, or targeted advertising directed at children.
• The Processor shall cooperate with any grievance redressal mechanisms established by the Controller under the DPDP Act and Rules and shall assist the Controller in responding to inquiries or directions from the Data Protection Board of India.

• The Processor shall securely handle Personal Data in accordance with the Controller's instructions and the requirements of the APPI.
• The Processor shall take necessary and appropriate measures to ensure the security of Personal Data, including preventing leakage, loss, or damage.
• For cross-border third-party transfers, the Processor shall ensure equivalent measures are in place in the recipient country or obtain individual consent as required under Article 28.
• The Processor shall cooperate with the Controller in responding to Data Subject requests for disclosure, correction, cessation of use, or deletion.
• The Processor shall notify the Controller without undue delay of any incident involving unauthorized access or leakage of Personal Data, to enable notification to the Personal Information Protection Commission (PPC) and affected individuals.
• The Processor shall retain Personal Data only for the period necessary for the agreed purposes and shall securely delete or return data upon completion of Processing.

• The Processor shall comply with the Security Principle under the Malaysia PDPA by implementing practical measures to protect Personal Data from loss, misuse, modification, unauthorized or accidental access, disclosure, alteration, or destruction.
• The Processor shall process Personal Data only for the purposes authorized by the Controller and shall not disclose data to any third party without the Controller's prior written consent.
• The Processor shall assist the Controller with obligations arising from 2025 and subsequent amendments, including mandatory breach notification to the Personal Data Protection Commissioner and affected Data Subjects.
• The Processor shall appoint a Data Protection Officer where required under the amended Malaysia PDPA.
• The Processor shall support the Controller in fulfilling Data Subject rights, including access and correction requests, within the prescribed timelines.
• The Processor shall retain Personal Data only for as long as necessary for the agreed purposes and shall securely dispose of data in accordance with the Retention Principle.

• The Processor shall process Personal Data only on the Controller's documented instructions and in compliance with the Mauritius Data Protection Act 2017.
• The Processor shall implement appropriate technical and organizational security measures to protect Personal Data, as required under the Mauritius DPA, including measures to prevent unauthorized access, disclosure, alteration, or destruction.
• The Processor shall assist the Controller in fulfilling Data Subject rights, including rights to access, rectification, erasure, and objection, within the prescribed timelines.
• The Processor shall not transfer Personal Data outside Mauritius unless the recipient country provides adequate protection or appropriate safeguards are in place (e.g., contractual clauses, consent, or authorization from the Data Protection Office).
• The Processor shall notify the Controller without undue delay of any Data Breach and shall cooperate with the Data Protection Office (DPO) as required.
• The Processor shall retain Personal Data only for as long as necessary for the agreed purposes and shall securely delete or return data upon termination of the engagement.

• The Processor (as Agent) shall process Personal Data only for the lawful purpose connected with the Controller's functions or activities (IPP 1), collect only what is necessary, and not use or disclose beyond authorized limits (IPPs 10–11).
• The Processor shall take reasonable steps under IPP 5 to protect Personal Data from loss, unauthorized access, use, modification, or disclosure.
• For any disclosure outside New Zealand, the Processor shall comply with IPP 12 by ensuring reasonable belief in comparable safeguards (e.g., via contractual terms, OPC model clauses, equivalent laws, or informed authorization from the individual).
• The Processor shall assist the Controller with access and correction requests (IPPs 6–7), complaints handling, and breach notifications under the Notifiable Data Breaches scheme (if serious harm is likely).
• The Processor shall comply with IPP 3A (notification for indirect collection, effective May 1, 2026) as applicable.
• The Processor shall retain Personal Data only for as long as necessary for the agreed purposes and shall securely dispose of or return data when no longer required.

• The Processor shall process Personal Data only on the Controller's documented instructions and for the agreed purposes, in compliance with the Oman PDPL.
• The Processor shall obtain explicit consent for cross-border transfers of Personal Data unless an exception applies and shall ensure recipient safeguards are in place.
• The Processor shall implement appropriate security measures to protect Personal Data from unauthorized access, loss, alteration, or disclosure.
• The Processor shall notify the Controller without undue delay of any Data Breach and shall assist with notifications from the relevant authority.
• The Processor shall support the Controller in fulfilling Data Subject rights, including access, correction, and erasure requests.
• The Processor shall retain Personal Data only for the period necessary to fulfill the agreed Processing purposes and shall securely delete or return data upon termination.

• The Processor shall process Personal Data only on the Controller's documented instructions and in compliance with Peru's PDPL (Law No. 29733) and its implementing regulations (Decree No. 003-2013-JUS).
• The Processor shall implement appropriate technical, organizational, and legal security measures to protect Personal Data, as required under the PDPL and its regulations.
• The Processor shall assist the Controller in fulfilling Data Subject rights, including rights to access, rectification, cancellation (deletion), and objection (ARCO rights), within the prescribed timelines.
• The Processor shall not transfer Personal Data outside Peru unless the recipient country provides adequate protection or an exception applies (e.g., contractual clauses, consent, or international treaty).
• The Processor shall notify the Controller without undue delay of any Data Breach and shall cooperate with the Controller in responding to inquiries from the Autoridad Nacional de Protección de Datos Personales (ANPDP).
• The Processor shall retain Personal Data only for as long as necessary for the agreed purposes and shall securely delete or return data upon termination of the engagement.

• The Processor (as Personal Information Processor or "PIP") shall process Personal Data only on documented instructions, implement reasonable security measures (organizational, physical, and technical), and notify the Controller of breaches without undue delay.
• Where applicable thresholds are met (e.g., more than 250 employees or sensitive data of more than 1,000 individuals), the Processor shall register data processing systems with the National Privacy Commission.
• The Processor shall appoint a Data Protection Officer and ensure any sub-PIPs comply with equivalent obligations.
• The Processor shall retain Personal Data only for as long as necessary to fulfill the specified Processing purposes and shall securely dispose of data thereafter.
• The Processor shall cooperate with the Controller and the National Privacy Commission in the event of any investigation, complaint, or compliance review.

• The Processor shall process Personal Data only for the purposes authorized by the Controller and in compliance with applicable Puerto Rico privacy laws, including the Puerto Rico Citizen Information on Data Banks Security Act (Act No. 111-2005) and any other applicable federal or territorial privacy requirements.
• The Processor shall implement reasonable security measures to protect Personal Data from unauthorized access, disclosure, or use.
• The Processor shall notify the Controller without undue delay of any Data Breach involving Personal Data of Puerto Rico residents, to enable the Controller to comply with applicable breach notification requirements.
• The Processor shall assist the Controller in responding to Data Subject requests as required under applicable Puerto Rico and U.S. federal privacy laws.
• The Processor shall retain Personal Data only for as long as necessary for the agreed Processing purposes and shall securely delete or return data upon termination.

• The Processor shall provide sufficient guarantees regarding the implementation of appropriate technical and organizational measures as required under Article 8 of the Saudi PDPL.
• The Processor shall process Personal Data only on the Controller's documented instructions and solely for the agreed purposes.
• The Processor shall notify SDAIA within 72 hours of becoming aware of a Data Breach where required and shall assist the Controller in notifying affected Data Subjects.
• The Processor shall use transfer mechanisms such as adequacy decisions, SCCs, or assessments approved by SDAIA for any cross-border transfer of Personal Data.
• The Processor shall support the Controller in fulfilling Data Subject rights, including rights of access, correction, and deletion under the Saudi PDPL.
• The Processor shall retain Personal Data only for as long as necessary for the specified purposes and shall securely delete or return data upon completion of Processing or termination of the engagement.

• The Processor (as Data Intermediary) shall process Personal Data only for the agreed purposes and in accordance with the Controller's documented instructions (PDPA Sections 24–26).
• The Processor shall notify the Controller of any Data Breach without undue delay to enable notification to the PDPC within the prescribed timelines where significant harm is likely.
• The Processor shall retain data only as necessary for the agreed purposes and shall securely delete or return Personal Data upon termination of the engagement.
• The Processor shall ensure transfers outside Singapore maintain comparable protection standards through contractual or other appropriate safeguards.
• The Processor shall assist with Do-Not-Call obligations if the Processing involves marketing communications.
• The Processor shall cooperate with the PDPC in any investigation or inquiry and shall maintain adequate records of Processing activities carried out on behalf of the Controller.

• The Processor (as Operator) shall process Personal Data only with the Controller's authorization and solely for the purposes specified in this DPA, in accordance with Section 21 of POPIA.
• The Processor shall implement appropriate security safeguards, including technical and organizational measures, to protect Personal Data against loss, damage, unauthorized destruction, or unlawful access.
• The Processor shall provide immediate breach notification to the Controller upon becoming aware of any compromise of Personal Data, to enable the Controller to notify the Information Regulator and affected Data Subjects as required under Section 22.
• The Processor shall treat all Personal Data as confidential and shall ensure that personnel authorized to process data are subject to appropriate confidentiality obligations.
• The Processor shall support the Controller in fulfilling Data Subject rights, including rights to access, correction, and deletion as provided under POPIA.
• The Processor shall securely delete or return all Personal Data upon termination of the engagement and shall not retain copies except as required by South African law.

• The Processor shall process Personal Data strictly in accordance with the Controller's instructions and the scope specified in this DPA, as required under PIPA.
• The Processor shall implement technical, administrative, and physical safeguards to protect Personal Data from unauthorized access, leakage, alteration, or destruction.
• For cross-border transfers, the Processor shall ensure adequate safeguards are in place through adequacy determinations, individual consent, or certification mechanisms as prescribed under PIPA.
• The Processor shall assist the Controller in responding to Data Subject rights requests, including access, correction, suspension of Processing, and deletion.
• The Processor shall notify the Controller without undue delay of any Data Breach and shall cooperate with the Personal Information Protection Commission (PIPC) as required.
• The Processor shall disclose the outsourcing arrangement and the identity of the Processor to Data Subjects as required under PIPA's entrustment notification provisions.

• The Processor shall process Personal Data per the Controller's orders as required under Section 40 of the Thailand PDPA and shall ensure binding contractual safeguards are in place.
• The Processor shall implement appropriate security measures to prevent unauthorized access, loss, alteration, or disclosure of Personal Data.
• The Processor shall assist the Controller with Data Subject rights requests, including access, correction, deletion, portability, and objection, within the timelines prescribed under the Thailand PDPA.
• The Processor shall notify the Controller without undue delay of any Data Breach, to enable the Controller to report to the PDPC Thailand and affected Data Subjects within the statutory timelines.
• For cross-border transfers, the Processor shall ensure adequate safeguards are in place, including adequacy determinations or contractual mechanisms as approved by the PDPC Thailand.
• The Processor shall maintain records of Processing activities and shall cooperate with the PDPC Thailand in any investigation or compliance inquiry.

• Processing shall be fair, transparent, and based on consent or another legal basis under UAE PDPL Article 4 and DIFC DPL Article 9.
• The Processor shall implement appropriate security measures to protect Personal Data from unauthorized access, loss, or disclosure.
• The Processor shall assist the Controller with DPIAs under DIFC DPL Article 32 and shall cooperate with the UAE Data Office and DIFC Commissioner as required.
• The Processor shall ensure adequacy or appropriate safeguards for cross-border transfers, including use of SCCs under DIFC DPL Article 27 or compliance with UAE PDPL Article 20.
• The Processor shall support the Controller in fulfilling Data Subject rights, including the rights of access, rectification, erasure, and objection to Processing.
• The Processor shall retain Personal Data only for as long as necessary for specified purposes and shall securely delete or return data upon termination of the engagement.

• The Processor shall act solely as a “Service Provider” or “Processor” under CCPA/CPRA and US State Privacy Laws and shall not sell, share, or use Personal Data for targeted advertising or cross-context behavioral advertising without consent.
• The Processor shall assist with consumer rights requests, including rights to access, deletion, correction, opt-out of sale or sharing, and the right to limit use of Sensitive Personal Data.
• The Processor shall conduct data protection assessments for high-risk Processing activities as required under applicable US State Privacy Laws.
• The Processor shall comply with de-identification requirements and shall not attempt to re-identify de-identified data.
• The Processor certifies that it understands and will comply with the restrictions on use, retention, and disclosure of Personal Data set forth in this DPA and applicable US State Privacy Laws.
• The Processor shall cooperate with the Controller in responding to verifiable consumer requests within the statutory timelines (e.g., 45 days under CCPA/CPRA).